CVE-2026-97558: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-25h5-cphg-25gg
Share
Published
Advisory Summary

CVE-2026-97558 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-97558 at a Glance

CVE Identifier CVE-2026-97558
GHSA Identifier GHSA-25h5-cphg-25gg
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-97558

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-97558, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix cifsFileInfo reference leak in deferred close When cifs_close() defers a close, it hands the cifsFileInfo reference of the closing struct file to the queued work. Each execution of smb2_deferred_work_close() drops one such reference. deferred_close_scheduled can be false while the work is pending: the workqueue clears PENDING when the callback starts to run, before the callback clears the flag under deferred_lock. A close in that interval requeues the running work, and the callback then clears the flag, leaving the requeued work pending with the flag down. A later cifs_open() can reuse the handle and its cifs_close() reaches the same branch: queue_delayed_work() fails because the work is still pending, but cifs_close() returns without dropping the closing file's reference. The cifsFileInfo count stays pinned and its tlink, dentry and server handle are leaked. Check the return value and hand off the reference only when work was actually queued. Otherwise, use the shared _cifsFileInfo_put(), like the mod_delayed_work() branch above: the pending execution already owns its reference. This issue was found by an in-house static analysis tool.

References

NVD — CVE-2026-97558 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-97558
git.kernel.org/stable/c/5520e89a5a... WEB
https://git.kernel.org/stable/c/5520e89a5a4f834bced64cf2ac927001cc513a40
git.kernel.org/stable/c/a676771290... WEB
https://git.kernel.org/stable/c/a6767712902beb0f53238be485971c9a83ea1079
git.kernel.org/stable/c/bbeb7a42c9... WEB
https://git.kernel.org/stable/c/bbeb7a42c9ea656e17ddcbdc2d7917aa853383a6
git.kernel.org/stable/c/ea93759d6c... WEB
https://git.kernel.org/stable/c/ea93759d6c2789924f4e557aed5be532207715ea

Frequently Asked Questions

What is CVE-2026-97558?
CVE-2026-97558 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-97558?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-97558?
CVE-2026-97558 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-97558?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-25h5-cphg-25gg",
  "modified" : "2026-10-15T12:30:53Z",
  "published" : "2026-09-25T12:31:24Z",
  "aliases" : [ "CVE-2026-97558" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix cifsFileInfo reference leak in deferred close\n\nWhen cifs_close() defers a close, it hands the cifsFileInfo reference\nof the closing struct file to the queued work. Each execution of\nsmb2_deferred_work_close() drops one such reference.\n\ndeferred_close_scheduled can be false while the work is pending: the\nworkqueue clears PENDING when the callback starts to run, before the\ncallback clears the flag under deferred_lock. A close in that\ninterval requeues the running work, and the callback then clears the\nflag, leaving the requeued work pending with the flag down. A later\ncifs_open() can reuse the handle and its cifs_close() reaches the\nsame branch: queue_delayed_work() fails because the work is still\npending, but cifs_close() returns without dropping the closing file's\nreference. The cifsFileInfo count stays pinned and its tlink, dentry\nand server handle are leaked.\n\nCheck the return value and hand off the reference only when work was\nactually queued. Otherwise, use the shared _cifsFileInfo_put(), like\nthe mod_delayed_work() branch above: the pending execution already\nowns its reference.\n\nThis issue was found by an in-house static analysis tool.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-97558"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5520e89a5a4f834bced64cf2ac927001cc513a40"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a6767712902beb0f53238be485971c9a83ea1079"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/bbeb7a42c9ea656e17ddcbdc2d7917aa853383a6"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ea93759d6c2789924f4e557aed5be532207715ea"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-25T11:17:06Z"
  }
}